coderifts 8.2.0 → 8.4.0

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "8.2.0",
+      version: "8.4.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3071,10 +3071,11 @@ var require_package = __commonJS({
         prepublishOnly: "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build && bash ../../scripts/release-check.sh .",
         "assert-guard-major": "node scripts/assert-guard-major.js",
         postinstall: "node scripts/postinstall.js",
-        test: "node --test test/*.test.js"
+        test: "node --test test/*.test.js",
+        "check:packed": "node scripts/check-packed-install.js"
       },
       dependencies: {
-        "@coderifts/agent-guard": "^17.0.0",
+        "@coderifts/agent-guard": "^17.1.0",
         chalk: "^4.1.2",
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
@@ -71328,7 +71329,21 @@ These feed DIFFERENT halves of the system \u2014 the top level binds the ATOMIC
       ["target_uri", "targetUri"],
       ["tenant_id", "tenantId"],
       ["policy_hash", "policyHash"],
-      ["audience_hash", "audienceHash"],
+      // 1402 — `audience_hash` IS NOT ON THIS LIST, and its absence is the fix.
+      //
+      // MEASURED 2026-09-06 against the server, read-only:
+      //   src/change-set.js:1138            reads TOP-LEVEL `input.audience`, strict /^v:[0-9a-f]{12}$/
+      //   execution-grant-v2.js:166         derives `audience_hash: sha256pref(audience)` ITSELF
+      //   execution-grant-request.v2.producer.json  states it outright: "`audience_hash` is NOT a
+      //                                     request field of its own … sending it separately has no
+      //                                     effect and it stays out of this schema"
+      //
+      // So the Guard was sending a field nobody reads. Worse, it was ALSO sending the audience under
+      // `context.audience`, which the handler does not read either (it reads `input.audience`) — both
+      // channels were severed, and the binding a host configured reached the server through neither.
+      // A field that looks bound and is not is the exact failure the server's own 1206 note describes.
+      //
+      // The fix is to send what the server consumes: top-level `audience`. See guard.ts.
       ["expected_state_token", "expectedStateToken"]
     ]);
     function v2WireFields(config) {
@@ -71872,6 +71887,17 @@ var require_guard = __commonJS({
         previous_receipt: resolvePreviousReceipt(config),
         idempotency_key: void 0
       };
+      if (typeof config.audience === "string" && config.audience.length > 0) {
+        if (/^v:[0-9a-f]{12}$/.test(config.audience)) {
+          request.audience = config.audience;
+        } else {
+          emit(config, {
+            type: "audience_not_bindable",
+            at: iso(),
+            cause: `audience ${JSON.stringify(config.audience)} is not the measured v:<12 hex> form; the server discards any other string to null, so it would NOT be bound. Nothing was sent for it.`
+          });
+        }
+      }
       let grantObs;
       let grantForCall = null;
       if ((0, execution_grant_js_1.isExecutionGrantEnabled)(config)) {
@@ -227190,7 +227216,11 @@ var require_mcp_streamable = __commonJS({
       DECISION_ENUM,
       EXECUTION_ACTION_ENUM
     } = require_mcp_decision_result_shape();
-    var { GRANT_DEFAULT_V2_DATE, GRANT_VERSION_V1 } = require_grant_version_default();
+    var {
+      GRANT_DEFAULT_V2_DATE,
+      GRANT_VERSION_V1,
+      resolveGrantVersion
+    } = require_grant_version_default();
     var TOOL_SOURCE = {
       preflight_check: "diff",
       agent_tool_check: "diff",
@@ -227598,8 +227628,10 @@ next_agent_step is a suggestion, not permission.`;
                 // 1363: JSON Schema `default` is a SINGLE static value. A date-gated default cannot
                 // be that without lying on one side of the cutoff. The 1344 mechanism (resolver +
                 // GRANT_DEFAULT_V2_DATE) is unchanged; this is the schema expression of it.
-                // `x-coderifts-effective-default` is the value omitting the field yields TODAY
-                // (migration window). `x-coderifts-default-changes-at` is when that becomes v2.
+                // 1384: the TEMPLATE here is the frozen surface constant (GRANT_VERSION_V1).
+                // visibleTools() stamps the LIVE omit-value from resolveGrantVersion so the
+                // served header is truthful on both sides of 2026-09-18. tools_sha256 hashes
+                // the frozen constant, not the live value (volatile; see toolsForSurfaceDigest).
                 "x-coderifts-effective-default": GRANT_VERSION_V1,
                 "x-coderifts-default-changes-at": GRANT_DEFAULT_V2_DATE,
                 description: "Grant envelope to mint when include_execution_grant is true. Omitting this yields cr.exec.v1 until " + GRANT_DEFAULT_V2_DATE + ' and cr.exec.v2 on and after it (see x-coderifts-effective-default / x-coderifts-default-changes-at). The response meta.grant_version is the version actually issued. An explicit value always wins \u2014 pin "v1" to keep current behaviour with no code change on the date.'
@@ -227850,9 +227882,29 @@ next_agent_step is a suggestion, not permission.`;
     function toolByName(name) {
       return MCP_MANIFEST.tools.find((t) => t.name === name);
     }
-    function visibleTools({ includeAdvanced = false } = {}) {
+    function mapGrantVersionExt(tools, fn) {
+      return (Array.isArray(tools) ? tools : []).map((t) => {
+        const gv = t && t.inputSchema && t.inputSchema.properties && t.inputSchema.properties.grant_version;
+        if (!gv) return t;
+        const copy = JSON.parse(JSON.stringify(t));
+        copy.inputSchema.properties.grant_version = fn(copy.inputSchema.properties.grant_version);
+        return copy;
+      });
+    }
+    function visibleTools({ includeAdvanced = false, now } = {}) {
       const names = includeAdvanced ? [...CANONICAL_TOOL_NAMES, ...ADVANCED_TOOL_NAMES] : [...CANONICAL_TOOL_NAMES];
-      return names.map(toolByName).filter(Boolean);
+      const tools = names.map(toolByName).filter(Boolean);
+      const live = resolveGrantVersion({}, { now }).version;
+      return mapGrantVersionExt(tools, (gv) => {
+        gv["x-coderifts-effective-default"] = live;
+        return gv;
+      });
+    }
+    function toolsForSurfaceDigest(tools) {
+      return mapGrantVersionExt(tools, (gv) => {
+        gv["x-coderifts-effective-default"] = GRANT_VERSION_V1;
+        return gv;
+      });
     }
     var SERVER_INFO = { name: "CodeRifts API Governance", version: "1.0.2" };
     var SUPPORTED_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
@@ -228136,6 +228188,8 @@ next_agent_step is a suggestion, not permission.`;
     module2.exports.MCP_MANIFEST = MCP_MANIFEST;
     module2.exports.SERVER_INFO = SERVER_INFO;
     module2.exports.visibleTools = visibleTools;
+    module2.exports.toolsForSurfaceDigest = toolsForSurfaceDigest;
+    module2.exports.EFFECTIVE_DEFAULT_VOLATILE_KEY = "x-coderifts-effective-default";
     module2.exports.CANONICAL_TOOL_NAMES = CANONICAL_TOOL_NAMES;
     module2.exports.ADVANCED_TOOL_NAMES = ADVANCED_TOOL_NAMES;
     module2.exports.HIDDEN_ALIAS_NAMES = HIDDEN_ALIAS_NAMES;
@@ -228270,14 +228324,15 @@ var require_generate_surface_anchor = __commonJS({
     }
     function buildAnchor(opts = {}) {
       const includeAdvanced = opts.includeAdvanced === true;
-      const tools = mcp.visibleTools({ includeAdvanced });
+      const tools = mcp.visibleTools({ includeAdvanced, now: opts.now });
+      const digestTools = typeof mcp.toolsForSurfaceDigest === "function" ? mcp.toolsForSurfaceDigest(tools) : tools;
       const profile = buildRequestProfile({
         endpoint: ENDPOINT,
         method: "tools/list",
         headers: {},
         params: includeAdvanced ? { include_advanced_tools: true } : {}
       });
-      const digest = crypto.createHash("sha256").update(canonicalJson(tools), "utf8").digest("hex");
+      const digest = crypto.createHash("sha256").update(canonicalJson(digestTools), "utf8").digest("hex");
       return {
         profile,
         tools_sha256: `sha256:${digest}`,
@@ -230166,6 +230221,272 @@ var require_deploy_gate2 = __commonJS({
   }
 });
 
+// src/doctor.js
+var require_doctor = __commonJS({
+  "src/doctor.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    function harness() {
+      return require(path.join(__dirname, "..", "..", "..", "benchmark", "tool-selection-benchmark.js"));
+    }
+    var PREFLIGHT = "preflight_change_set";
+    function bare(name) {
+      return String(name == null ? "" : name).replace(/^coderifts\./, "");
+    }
+    function parseToolsDocument(doc) {
+      if (Array.isArray(doc)) return { ok: true, tools: doc };
+      if (doc && Array.isArray(doc.tools)) return { ok: true, tools: doc.tools };
+      if (doc && doc.result && Array.isArray(doc.result.tools)) return { ok: true, tools: doc.result.tools };
+      return {
+        ok: false,
+        why: "expected a tools/list response \u2014 an array, { tools: [...] }, or { result: { tools: [...] } }"
+      };
+    }
+    function descriptionOf(t) {
+      return typeof t.description === "string" ? t.description : "";
+    }
+    function schemaOf(t) {
+      return t.inputSchema || t.input_schema || t.parameters || void 0;
+    }
+    function signalPreflightPresent(tools) {
+      const hit = tools.find((t) => bare(t.name) === PREFLIGHT);
+      return hit ? { ok: true, detail: `\`${bare(hit.name)}\` is in the table` } : {
+        ok: false,
+        detail: `no \`${PREFLIGHT}\` tool in the table \u2014 nothing to select for a contract change`,
+        fix: "coderifts agent-setup"
+      };
+    }
+    function signalDescriptionMatchesShipped(tools, shipped) {
+      const hit = tools.find((t) => bare(t.name) === PREFLIGHT);
+      if (!hit) return { ok: false, detail: "not applicable \u2014 no preflight tool", fix: "coderifts agent-setup" };
+      const ship = shipped.find((t) => bare(t.name) === PREFLIGHT);
+      if (!ship) return { ok: false, detail: "the shipped manifest carries no preflight tool to compare against" };
+      const mine = descriptionOf(hit).trim();
+      const theirs = descriptionOf(ship).trim();
+      if (mine === theirs) return { ok: true, detail: "description is byte-identical to the shipped text" };
+      const pct = theirs.length ? Math.round(mine.length / theirs.length * 100) : 0;
+      return {
+        ok: false,
+        detail: `description DRIFTED from the shipped text (${mine.length} vs ${theirs.length} chars, ${pct}%) \u2014 the model reads this to decide, so a shortened or stale copy changes selection`,
+        fix: "coderifts agent-setup --force"
+      };
+    }
+    function signalSchemaValid(tools, h) {
+      const checks = [];
+      const attempt = (label, fn, arg) => {
+        try {
+          fn(arg);
+          checks.push({ label, ok: true });
+        } catch (err) {
+          checks.push({ label, ok: false, why: err && err.message || "rejected" });
+        }
+      };
+      const anthropicShape = tools.map((t) => ({ name: bare(t.name), description: descriptionOf(t), input_schema: schemaOf(t) }));
+      if (typeof h.validateAnthropicTools === "function") attempt("anthropic", h.validateAnthropicTools, anthropicShape.map(h.toAnthropicTool || ((x) => x)));
+      if (typeof h.validateOpenAITools === "function") attempt("openai", h.validateOpenAITools, anthropicShape.map(h.toOpenAITool || ((x) => x)));
+      if (typeof h.validateGoogleTools === "function") attempt("google", h.validateGoogleTools, anthropicShape.map(h.toGoogleFunctionDeclaration || ((x) => x)));
+      const bad = checks.filter((c) => !c.ok);
+      return bad.length === 0 ? { ok: true, detail: `accepted by ${checks.map((c) => c.label).join(", ") || "(no validator available)"}` } : {
+        ok: false,
+        detail: `rejected by ${bad.map((c) => `${c.label} (${c.why})`).join("; ")}`,
+        fix: "coderifts agent-setup --force"
+      };
+    }
+    var RIVAL_HINTS = ["breaking", "openapi", "contract", "api diff", "api change", "schema diff"];
+    function signalNoAbsorbingRival(tools, shipped = []) {
+      const own = new Set(shipped.map((t) => bare(t.name)));
+      const rivals = tools.filter((t) => bare(t.name) !== PREFLIGHT && !own.has(bare(t.name))).filter((t) => {
+        const text = `${bare(t.name)} ${descriptionOf(t)}`.toLowerCase();
+        return RIVAL_HINTS.some((h) => text.includes(h));
+      }).map((t) => bare(t.name));
+      return rivals.length === 0 ? { ok: true, detail: "no other tool advertises contract-change checking" } : {
+        ok: false,
+        warning: true,
+        detail: `${rivals.length} other tool(s) advertise contract-change work and may absorb the call: ` + rivals.join(", ") + " \u2014 Tier 1 measures whether they actually do",
+        fix: null
+      };
+    }
+    function tier0(tools) {
+      const h = harness();
+      const shipped = h.getCanonicalTools();
+      const signals = [
+        { id: "preflight_present", ...signalPreflightPresent(tools) },
+        { id: "description_matches_shipped", ...signalDescriptionMatchesShipped(tools, shipped) },
+        { id: "schema_valid", ...signalSchemaValid(tools, h) },
+        { id: "no_absorbing_rival", ...signalNoAbsorbingRival(tools, shipped) }
+      ];
+      const blocking = signals.filter((s) => !s.ok && !s.warning);
+      return {
+        tier: 0,
+        tool_count: tools.length,
+        signals,
+        passed: signals.filter((s) => s.ok).length,
+        total: signals.length,
+        blocking: blocking.length,
+        fixes: [...new Set(signals.filter((s) => !s.ok && s.fix).map((s) => s.fix))]
+      };
+    }
+    var DOES_NOT_PROVE = Object.freeze({
+      0: [
+        "that your model WOULD select CodeRifts \u2014 Tier 0 is structural only, a necessary condition",
+        "that a change reached a merge/deploy/publish sink, or that any gate fired",
+        "anything about tools this file was not shown"
+      ],
+      1: [
+        "that a change reached a merge/deploy/publish sink \u2014 selection is not enforcement",
+        "anything about a model other than the one you ran, at the version you ran it",
+        "that your production prompt behaves like the harness prompt"
+      ]
+    });
+    module2.exports = {
+      parseToolsDocument,
+      tier0,
+      harness,
+      bare,
+      DOES_NOT_PROVE,
+      PREFLIGHT,
+      signalPreflightPresent,
+      signalDescriptionMatchesShipped,
+      signalSchemaValid,
+      signalNoAbsorbingRival
+    };
+  }
+});
+
+// src/commands/doctor.js
+var require_doctor2 = __commonJS({
+  "src/commands/doctor.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var chalk = require_source();
+    var {
+      parseToolsDocument,
+      tier0,
+      harness,
+      DOES_NOT_PROVE
+    } = require_doctor();
+    function readToolsFile(file) {
+      const resolved = path.resolve(file);
+      if (!fs.existsSync(resolved)) return { ok: false, why: `no such file: ${file}` };
+      let doc;
+      try {
+        doc = JSON.parse(fs.readFileSync(resolved, "utf8"));
+      } catch (err) {
+        return { ok: false, why: `not JSON: ${err && err.message || "parse error"}` };
+      }
+      return parseToolsDocument(doc);
+    }
+    function printBoundary(tier, log) {
+      log("");
+      log(chalk.bold("  WHAT THIS DOES NOT PROVE"));
+      for (const line of DOES_NOT_PROVE[tier]) log(chalk.dim(`    \xB7 ${line}`));
+    }
+    function renderTier0(r, log) {
+      log("");
+      log(chalk.bold(`  coderifts doctor \u2014 structural fitness (${r.tool_count} tools, no model called)`));
+      log("");
+      for (const s of r.signals) {
+        const mark = s.ok ? chalk.green("  ok  ") : s.warning ? chalk.yellow("  !!  ") : chalk.red("  X   ");
+        log(`${mark}${s.id}`);
+        log(chalk.dim(`        ${s.detail}`));
+      }
+      log("");
+      const verdict = r.blocking === 0 ? chalk.green(`  structurally fit to be selected: ${r.passed}/${r.total} signals`) : chalk.red(`  NOT structurally fit: ${r.blocking} blocking signal(s), ${r.passed}/${r.total} passed`);
+      log(verdict);
+      if (r.fixes.length) {
+        log("");
+        log(chalk.bold("  NEXT COMMAND"));
+        for (const f of r.fixes) log(`    ${chalk.cyan(f)}`);
+      }
+      log("");
+      log(chalk.dim("  Tier 0 is the NECESSARY condition, not selectability. To measure whether your"));
+      log(chalk.dim("  model actually selects, run the 15 fixtures on your own key:"));
+      log(chalk.dim("    coderifts doctor --tools <file> --model <model-id>"));
+    }
+    async function runTier1({ tools, model, log, mock }) {
+      const h = harness();
+      const fixtures = h.loadSelectionFixtures();
+      log("");
+      log(chalk.bold(`  coderifts doctor \u2014 selection benchmark (${fixtures.length} fixtures, model ${model})`));
+      let client;
+      if (mock) {
+        client = new h.MockClient(h.perfectScript());
+        log(chalk.yellow("  MOCK RUN \u2014 a scripted model that answers perfectly by construction."));
+        log(chalk.yellow("  This measures the script. It is not a measurement of any model."));
+      } else {
+        const provider = h.PROVIDERS && Object.keys(h.PROVIDERS).find((p) => String(model).toLowerCase().includes(p));
+        const factory = provider === "openai" ? h.createOpenAIClient : provider === "google" ? h.createGoogleClient : provider === "xai" ? h.createXaiClient : h.createAnthropicClient;
+        const envVar = provider === "openai" ? "OPENAI_API_KEY" : provider === "google" ? "GOOGLE_API_KEY" : provider === "xai" ? "XAI_API_KEY" : "ANTHROPIC_API_KEY";
+        const key = process.env[envVar];
+        if (!key) {
+          log("");
+          log(chalk.red(`  ${envVar} is not set.`));
+          log(chalk.dim("  Tier 1 runs on YOUR key, on YOUR machine. CodeRifts never sees it, and"));
+          log(chalk.dim("  never pays for the run. Export the key and re-run, or use --mock for a"));
+          log(chalk.dim("  no-cost dry run of the harness path."));
+          return { ok: false, reason: "missing_key" };
+        }
+        client = factory({ apiKey: key, model });
+      }
+      const userNames = new Set(tools.map((t) => String(t.name || "").replace(/^coderifts\./, "")));
+      const withUserTable = fixtures.map((f) => ({
+        ...f,
+        available_tools: f.available_tools.filter((n) => userNames.has(String(n).replace(/^coderifts\./, "")))
+      }));
+      const unreachable = withUserTable.filter((f) => f.available_tools.length === 0).length;
+      if (unreachable) {
+        log(chalk.yellow(`  ${unreachable} fixture(s) have no matching tool in your table \u2014 they can only score as a miss.`));
+      }
+      const unanswerable = withUserTable.filter((f) => {
+        const want = String(f.expected_tool || "").replace(/^coderifts\./, "");
+        return want && want !== "none" && !userNames.has(want);
+      }).map((f) => f.id);
+      if (unanswerable.length) {
+        log(chalk.yellow(`  ${unanswerable.length} fixture(s) expect a tool your table does not offer (${unanswerable.join(", ")}) \u2014 they CANNOT score correct. That is your table, not your model.`));
+      }
+      const run = await h.runBenchmark({ modelId: model, client, fixtures: withUserTable });
+      const m = run && run.metrics ? run.metrics : h.computeMetrics(run.results || []);
+      log("");
+      for (const k of ["selection_coverage", "bypass_rate", "omission_rate", "wrong_tool_rate", "overall_accuracy"]) {
+        if (m[k] !== void 0) log(`    ${String(k).padEnd(20)} ${m[k]}`);
+      }
+      return { ok: true, metrics: m };
+    }
+    async function runDoctor(options = {}) {
+      const log = options.logFn || ((s) => process.stdout.write(`${s}
+`));
+      const exitFn = options.exitFn || ((c) => process.exit(c));
+      if (!options.tools) {
+        log(chalk.red("  --tools <file> is required: the tools/list your host actually serves."));
+        log(chalk.dim(`    Save it with your MCP client, or: curl .../mcp -d '{"method":"tools/list"}' > tools.json`));
+        exitFn(2);
+        return { exitCode: 2 };
+      }
+      const parsed = readToolsFile(options.tools);
+      if (!parsed.ok) {
+        log(chalk.red(`  could not read the tool table: ${parsed.why}`));
+        exitFn(2);
+        return { exitCode: 2 };
+      }
+      if (options.model) {
+        const r = await runTier1({ tools: parsed.tools, model: options.model, log, mock: !!options.mock });
+        printBoundary(1, log);
+        const code = r.ok ? 0 : 1;
+        exitFn(code);
+        return { exitCode: code, tier: 1, metrics: r.metrics };
+      }
+      const report = tier0(parsed.tools);
+      renderTier0(report, log);
+      printBoundary(0, log);
+      exitFn(0);
+      return { exitCode: 0, tier: 0, report };
+    }
+    module2.exports = { runDoctor, readToolsFile, renderTier0, printBoundary };
+  }
+});
+
 // src/commands/publish-gate.js
 var require_publish_gate = __commonJS({
   "src/commands/publish-gate.js"(exports2, module2) {
@@ -231171,7 +231492,9 @@ var require_required_check_contract = __commonJS({
     var CHECK_NAME = "CodeRifts / contract-gate";
     var GITHUB_ACTIONS_APP_ID = 15368;
     var GITHUB_ACTIONS_APP_SLUG = "github-actions";
-    var ENFORCING_ISSUER_APP_ID = GITHUB_ACTIONS_APP_ID;
+    var CODERIFTS_APP_ID = 2860592;
+    var CODERIFTS_APP_SLUG = "coderifts";
+    var ENFORCING_ISSUER_APP_ID = CODERIFTS_APP_ID;
     function extractRequiredContexts(protection) {
       if (!protection || typeof protection !== "object") return [];
       const rsc = protection.required_status_checks;
@@ -231185,6 +231508,8 @@ var require_required_check_contract = __commonJS({
       GITHUB_ACTIONS_APP_ID,
       GITHUB_ACTIONS_APP_SLUG,
       ENFORCING_ISSUER_APP_ID,
+      CODERIFTS_APP_ID,
+      CODERIFTS_APP_SLUG,
       extractRequiredContexts
     };
   }
@@ -231297,13 +231622,14 @@ jobs:
           # monitoring-attestation: \${{ vars.CODERIFTS_MONITORING_ATTESTATION }}
           # monitoring-keyring: \${{ github.workspace }}/.coderifts/monitoring-keys.json
           #
-          # Optional \u2014 require an execution grant (contract-gate \u22650.5.0). The gate accepts BOTH
-          # cr.exec.v1 and cr.exec.v2; the ATOMIC profile issues v2.
-          # OFF HERE, ON IN STRICT, and the difference is deliberate \u2014 same rule as the @v0 tag
-          # above. Turning it on BLOCKS every PR that changes a governed contract path and carries
-          # no valid grant (\`grant_not_supplied\`), so it needs a working way to mint and deliver
-          # one per change set before it helps. This template is the easy-onboarding one and stays
-          # non-blocking; \`coderifts init --agents --strict\` is where the gate is armed.
+          # Optional \u2014 require an execution grant (contract-gate \u22650.5.0). When armed, the
+          # production grant is cr.exec.v2; cr.exec.v1 is legacy. The gate accepts BOTH so a
+          # migration is not a hard cut. OFF HERE, ON IN STRICT, and the difference is deliberate
+          # \u2014 same rule as the @v0 tag above. Turning it on BLOCKS every PR that changes a
+          # governed contract path and carries no valid grant (\`grant_not_supplied\`), so it
+          # needs a working way to mint and deliver one per change set before it helps. This
+          # template is the easy-onboarding one and stays non-blocking;
+          # \`coderifts init --agents --strict\` is where the gate is armed.
           # Do not "fix" this on and do not "fix" strict off.
           # require-grant: 'true'
           # execution-grant: \${{ vars.CODERIFTS_EXECUTION_GRANT }}
@@ -231362,18 +231688,22 @@ jobs:
           # Without this the three layers disagreed: the guard demands a grant in strict mode, this
           # workflow demanded verified monitoring, and the merge gate let a grant-less change through.
           #
+          # PRIMARY GRANT: cr.exec.v2. Mint with grantVersion: 'v2' (or grant_version: 'v2').
+          # LEGACY: cr.exec.v1 (bound to operation \u2225 target_id \u2225 after_payload) still verifies;
+          # it is not what this template teaches. The gate accepts both so a migration PR is not
+          # a hard cut; do not take that as "v1 is the strict-install grant".
+          #
           # WHAT IT BLOCKS, exactly: a PR that changes a governed contract path
           # (openapi/graphql/grpc/asyncapi/mcp-manifest) and carries no valid grant (v1 or v2) fails
           # as \`grant_not_supplied\`. A PR that changes NO contract artifact is unaffected \u2014 the gate
           # short-circuits earlier as \`no_contract_changes\`. So the affected set is not "some PRs":
           # it is every PR this gate actually evaluates.
           #
-          # THE GRANT IS PER-CHANGE-SET. A grant binds operation \u2225 target_id \u2225
-          # after_payload, and after_payload is the AFTER-content of the changed governed files. A
-          # repository variable pinned once therefore covers exactly one diff and fails every other
-          # PR as \`grant_does_not_cover_path\`. The variable below is the delivery slot, not a
-          # set-and-forget value: mint the grant for the change set and publish it here, or replace
-          # this line with a step output from whatever mints yours.
+          # THE GRANT IS PER-CHANGE-SET. A v2 grant is bound to this change set's after-payload
+          # (and v2 identity fields). A repository variable pinned once therefore covers exactly
+          # one diff and fails every other PR as \`grant_does_not_cover_path\`. The variable below
+          # is the delivery slot, not a set-and-forget value: mint the grant for the change set
+          # and publish it here, or replace this line with a step output from whatever mints yours.
           require-grant: 'true'
           # 1094: prefer the per-PR grant comment (coderifts grant publish). The repo variable
           # is a leftover slot for one after_payload and does not bind head_sha.
@@ -231607,13 +231937,31 @@ var require_github_enforcement = __commonJS({
       CHECK_NAME,
       GITHUB_ACTIONS_APP_SLUG,
       ENFORCING_ISSUER_APP_ID,
+      CODERIFTS_APP_ID,
       extractRequiredContexts
     } = require_required_check_contract();
     var { GATE_ACTION } = require_contract_gate_workflow();
     var { inspectWorkflowYaml } = require_workflow_scan();
     var EVIDENCE_SPEC = "provider-enforcement-evidence.v2";
     var CODERIFTS_GITHUB_APP_SLUG = "coderifts";
-    var CODERIFTS_GITHUB_APP_ID = 2860592;
+    var CODERIFTS_GITHUB_APP_ID = CODERIFTS_APP_ID;
+    var CLAMP_RESIDUAL = 'the App check is clamped to "neutral" unless the server runs MERGEGATE_ENFORCE=true, and GitHub treats a neutral required check as passing. That setting is server-side and CANNOT BE DETERMINED FROM HERE, so this states which issuer is bound, not that the check will conclude failure on the next run.';
+    function isMergegateEnforceObservedTrue(v) {
+      return v === true || String(v == null ? "" : v).toLowerCase() === "true";
+    }
+    function reasonNamesUnobservableClamp(reason) {
+      const s = String(reason || "");
+      return s.includes(CLAMP_RESIDUAL) || /CANNOT BE DETERMINED FROM HERE/.test(s);
+    }
+    var BASIS_CLAMP_UNOBSERVABLE = "all six layers VERIFIED \u2014 binding proven; inescapable_deploy is false because enforcement requires MERGEGATE_ENFORCE, which is server-side and cannot be determined here.";
+    var BASIS_NOT_ALL_VERIFIED = "inescapable_deploy stays false until every layer is VERIFIED";
+    var BASIS_ENFORCE_OBSERVED = "all six layers VERIFIED and MERGEGATE_ENFORCE is observably true";
+    function clampOrObservedClause(mergegateEnforceObserved) {
+      if (isMergegateEnforceObservedTrue(mergegateEnforceObserved)) {
+        return "MERGEGATE_ENFORCE is observably true; the App check may conclude failure and block.";
+      }
+      return `VERIFIED IS ABOUT THE BINDING, NOT THE NEXT CONCLUSION: ${CLAMP_RESIDUAL}`;
+    }
     var REASON = Object.freeze({
       ISSUER_BOUND: "issuer_bound",
       NO_ISSUER_BINDING: "no_issuer_binding",
@@ -231743,7 +232091,7 @@ var require_github_enforcement = __commonJS({
       return out;
     }
     var RULESET_BYPASS_CAVEAT = " Bypass actors were not readable on this surface, so this does not establish that nobody can bypass the ruleset.";
-    function evaluateRuleset(rulesets, defaultBranch = null) {
+    function evaluateRuleset(rulesets, defaultBranch = null, opts = {}) {
       if (rulesets == null) {
         return {
           status: STATUS.UNVERIFIABLE,
@@ -231798,7 +232146,7 @@ var require_github_enforcement = __commonJS({
         return {
           status: STATUS.VERIFIED,
           reason_code: REASON.RULESET_ISSUER_BOUND,
-          reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to integration_id ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 the contract-gate Action, which concludes failure and blocks the merge. It targets ${defaultBranch ? `refs/heads/${defaultBranch}` : "the default branch"}.` + (bound.strict_policy === true ? " strict_required_status_checks_policy is ON, so a stale head cannot merge." : bound.strict_policy === false ? " RESIDUAL: strict_required_status_checks_policy is OFF, so a branch whose head is behind the base can merge on a check that passed against older bytes." : " strict_required_status_checks_policy was not readable here.") + RULESET_BYPASS_CAVEAT,
+          reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to integration_id ${ENFORCING_ISSUER_APP_ID} (slug ${CODERIFTS_GITHUB_APP_SLUG}) \u2014 the dedicated CodeRifts App, the issuer the ruleset requires. ` + clampOrObservedClause(opts.mergegateEnforceObserved) + ` It targets ${defaultBranch ? `refs/heads/${defaultBranch}` : "the default branch"}.` + (bound.strict_policy === true ? " strict_required_status_checks_policy is ON, so a stale head cannot merge." : bound.strict_policy === false ? " RESIDUAL: strict_required_status_checks_policy is OFF, so a branch whose head is behind the base can merge on a check that passed against older bytes." : " strict_required_status_checks_policy was not readable here.") + RULESET_BYPASS_CAVEAT,
           ruleset_names: names,
           app_id: ENFORCING_ISSUER_APP_ID,
           ref_targeted: true,
@@ -231886,9 +232234,9 @@ var require_github_enforcement = __commonJS({
         reason: `active ruleset "${pinned[0].ruleset}" requires workflow ${pinned[0].path} pinned to sha ${pinned[0].sha} in repository_id ${pinned[0].repository_id}. Moving that pin requires editing the ruleset (repository administration), which is a different permission from workflow write. This does NOT establish that any pull request ran it, nor that bypass actors cannot skip the ruleset.`
       };
     }
-    function evaluateRequiredCheckAcrossSurfaces(protection, rulesets, defaultBranch = null) {
-      const classic = evaluateRequiredCheck(protection);
-      const ruleset = evaluateRuleset(rulesets, defaultBranch);
+    function evaluateRequiredCheckAcrossSurfaces(protection, rulesets, defaultBranch = null, opts = {}) {
+      const classic = evaluateRequiredCheck(protection, opts);
+      const ruleset = evaluateRuleset(rulesets, defaultBranch, opts);
       const merged = (base) => ({
         ...base,
         surfaces_inspected: ["classic_branch_protection", rulesets == null ? "rulesets:unread" : "rulesets"],
@@ -231914,7 +232262,7 @@ var require_github_enforcement = __commonJS({
         reason: `${classic.reason} Rulesets were also inspected: ${ruleset.reason}. Neither surface binds "${CHECK_NAME}" to an issuer that can block.`
       });
     }
-    function evaluateRequiredCheck(protection) {
+    function evaluateRequiredCheck(protection, opts = {}) {
       const expected = expectedIssuerAppId();
       const rsc = protection && protection.required_status_checks;
       const contexts = extractRequiredContexts(protection);
@@ -231934,19 +232282,9 @@ var require_github_enforcement = __commonJS({
           return {
             status: STATUS.VERIFIED,
             reason_code: REASON.ISSUER_BOUND,
-            reason: `required_status_checks.checks binds "${CHECK_NAME}" to GitHub App id ${ENFORCING_ISSUER_APP_ID} (slug ${GITHUB_ACTIONS_APP_SLUG}) \u2014 the issuer the coderifts/contract-gate Action posts under, which concludes failure and blocks the merge. RESIDUAL: that issuer is shared by every GitHub Actions workflow in this repository, so anyone who can edit .github/workflows can post a passing check under it. Govern those paths too.`,
-            required_contexts: contexts,
-            app_id: ENFORCING_ISSUER_APP_ID
-          };
-        }
-        const advisory = ours.find((c) => numericAppId(c.app_id) === expected);
-        if (advisory) {
-          return {
-            status: STATUS.UNVERIFIABLE,
-            reason_code: REASON.ISSUER_ADVISORY_APP_UNOBSERVABLE,
-            reason: `required_status_checks.checks binds "${CHECK_NAME}" to CodeRifts App id ${expected} (slug ${CODERIFTS_GITHUB_APP_SLUG}). That check is advisory by default: it concludes "neutral" unless the server runs with MERGEGATE_ENFORCE=true, and GitHub treats a neutral required check as passing. MERGEGATE_ENFORCE is a server-side setting this CLI cannot observe, so whether this pin gates CANNOT BE DETERMINED FROM HERE. To get a check that provably blocks, bind "${CHECK_NAME}" to app_id ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 the contract-gate Action.`,
+            reason: `required_status_checks.checks binds "${CHECK_NAME}" to GitHub App id ${ENFORCING_ISSUER_APP_ID} (slug ${CODERIFTS_GITHUB_APP_SLUG}) \u2014 the dedicated CodeRifts App, the issuer the ruleset requires and the one observed concluding failure with the merge blocked. ` + clampOrObservedClause(opts.mergegateEnforceObserved),
             required_contexts: contexts,
-            app_id: expected,
+            app_id: ENFORCING_ISSUER_APP_ID,
             expected_app_id: ENFORCING_ISSUER_APP_ID
           };
         }
@@ -232112,11 +232450,12 @@ var require_github_enforcement = __commonJS({
       local,
       auth,
       rulesetsRead = null,
-      branch = null
+      branch = null,
+      mergegateEnforceObserved = null
     } = {}) {
       const layers = [];
       const localFiles = local || { contractGateFiles: [], deployGateFiles: [] };
-      const rulesetVerdict = evaluateRuleset(rulesetsRead, branch);
+      const rulesetVerdict = evaluateRuleset(rulesetsRead, branch, { mergegateEnforceObserved });
       const rulesetUpgrade = (classicLayerFields) => {
         if (rulesetVerdict.status !== STATUS.VERIFIED) return null;
         return {
@@ -232219,7 +232558,7 @@ var require_github_enforcement = __commonJS({
       } else {
         const protection = prot.body && typeof prot.body === "object" ? prot.body : {};
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
-        const required = evaluateRequiredCheck(protection);
+        const required = evaluateRequiredCheck(protection, { mergegateEnforceObserved });
         pushRequiredCheck({
           status: required.status,
           reason: required.reason,
@@ -232329,13 +232668,19 @@ var require_github_enforcement = __commonJS({
         }
       }
       const byId = Object.fromEntries(layers.map((l) => [l.id, l]));
-      const inescapable = LAYER_IDS.every((id) => byId[id] && byId[id].status === STATUS.VERIFIED);
+      const allVerified = LAYER_IDS.every((id) => byId[id] && byId[id].status === STATUS.VERIFIED);
+      const requiredLayer = byId.required_check;
+      const clampUnobservable = !!(requiredLayer && reasonNamesUnobservableClamp(requiredLayer.reason));
+      const inescapable = allVerified && !clampUnobservable;
+      let basis = BASIS_NOT_ALL_VERIFIED;
+      if (allVerified && clampUnobservable) basis = BASIS_CLAMP_UNOBSERVABLE;
+      else if (inescapable) basis = BASIS_ENFORCE_OBSERVED;
       return {
         layers,
         inescapable_deploy: inescapable,
         claim: {
           inescapable_deploy: inescapable,
-          basis: inescapable ? "all six layers VERIFIED (issuer-bound required check + active workflow jobs + correlated environment)" : "inescapable_deploy stays false until every layer is VERIFIED"
+          basis
         }
       };
     }
@@ -232424,6 +232769,12 @@ var require_github_enforcement = __commonJS({
       APP_INSTALLATION,
       NO_TOKEN_INSTRUCTION,
       LAYER_IDS,
+      CLAMP_RESIDUAL,
+      BASIS_CLAMP_UNOBSERVABLE,
+      BASIS_NOT_ALL_VERIFIED,
+      BASIS_ENFORCE_OBSERVED,
+      reasonNamesUnobservableClamp,
+      isMergegateEnforceObservedTrue,
       STATUS,
       FRESHNESS,
       EVIDENCE_TTL_SECONDS,
@@ -233875,6 +234226,825 @@ var require_mcp_repo_config = __commonJS({
   }
 });
 
+// src/atomic-v2-contract.js
+var require_atomic_v2_contract = __commonJS({
+  "src/atomic-v2-contract.js"(exports2, module2) {
+    "use strict";
+    var ADAPTER_CONTRACT_VERSION = "atomic-v2-adapter/1";
+    var ADAPTER_OPERATIONS = Object.freeze([
+      "state_challenge",
+      "consume",
+      "conditional_write",
+      "mutate",
+      "executor_attestation",
+      "provider_readback"
+    ]);
+    var REQUIRED_CAPABILITIES = ADAPTER_OPERATIONS;
+    var ADAPTER_CONTRACT = Object.freeze({
+      version: ADAPTER_CONTRACT_VERSION,
+      operations: Object.freeze({
+        state_challenge: Object.freeze({
+          in: Object.freeze(["target_id", "environment", "now"]),
+          out: Object.freeze(["ok", "state_nonce", "expires_at", "current_digest", "target_id", "jti", "scope_hash"])
+        }),
+        consume: Object.freeze({
+          in: Object.freeze(["state_nonce", "jti", "scope_hash", "target_id"]),
+          out: Object.freeze(["ok", "consumed", "jti"])
+        }),
+        conditional_write: Object.freeze({
+          in: Object.freeze(["target_id", "expected_digest", "payload"]),
+          out: Object.freeze(["ok", "new_digest"])
+        }),
+        mutate: Object.freeze({
+          in: Object.freeze(["target_id", "grant", "payload", "attestation"]),
+          out: Object.freeze(["ok", "attestation"])
+        }),
+        executor_attestation: Object.freeze({
+          in: Object.freeze(["target_id", "operation", "digest"]),
+          out: Object.freeze(["ok", "attestation", "executor_identity"])
+        }),
+        provider_readback: Object.freeze({
+          in: Object.freeze(["target_id"]),
+          out: Object.freeze(["ok", "digest", "target_id"])
+        })
+      })
+    });
+    function checkContractVersion(wiring) {
+      const found = wiring && wiring.contract_version;
+      if (found === ADAPTER_CONTRACT_VERSION) {
+        return { ok: true, expected: ADAPTER_CONTRACT_VERSION, found };
+      }
+      return {
+        ok: false,
+        expected: ADAPTER_CONTRACT_VERSION,
+        found: found == null ? null : String(found),
+        message: found == null ? `adapter-contract version missing (expected ${ADAPTER_CONTRACT_VERSION})` : `adapter-contract version mismatch: found ${found}, expected ${ADAPTER_CONTRACT_VERSION}`
+      };
+    }
+    module2.exports = {
+      ADAPTER_CONTRACT_VERSION,
+      ADAPTER_OPERATIONS,
+      ADAPTER_CONTRACT,
+      REQUIRED_CAPABILITIES,
+      checkContractVersion
+    };
+  }
+});
+
+// src/atomic-v2-claim.js
+var require_atomic_v2_claim = __commonJS({
+  "src/atomic-v2-claim.js"(exports2, module2) {
+    "use strict";
+    var TARGET_BINDING_FIELDS = Object.freeze([
+      "target_id",
+      "environment",
+      "executor_identity",
+      "operation",
+      "adapter_id"
+    ]);
+    function bindingPresent(input, key) {
+      const v = input && input[key];
+      return !(v == null || String(v).trim() === "");
+    }
+    function normalizeBound(input = {}) {
+      const bound = {};
+      for (const key of TARGET_BINDING_FIELDS) {
+        if (!bindingPresent(input, key)) {
+          return { ok: false, missing: key };
+        }
+        bound[key] = String(input[key]);
+      }
+      return { ok: true, bound };
+    }
+    function buildClaim(input = {}) {
+      const customer_target_verified = input.customer_target_verified === true;
+      const production_ready = input.production_ready === true;
+      if (production_ready === true && customer_target_verified !== true) {
+        const err = new Error(
+          "UNCONSTRUCTIBLE_CLAIM: customer_target_verified:false AND production_ready:true"
+        );
+        err.code = "UNCONSTRUCTIBLE_CLAIM";
+        throw err;
+      }
+      if (customer_target_verified) {
+        const binding = normalizeBound(input);
+        if (!binding.ok) {
+          const err = new Error(
+            `UNCONSTRUCTIBLE_CLAIM: customer_target_verified:true requires ${binding.missing}`
+          );
+          err.code = "UNCONSTRUCTIBLE_CLAIM";
+          throw err;
+        }
+        return Object.freeze({
+          customer_target_verified: true,
+          production_ready: true === production_ready,
+          target_id: binding.bound.target_id,
+          environment: binding.bound.environment,
+          executor_identity: binding.bound.executor_identity,
+          operation: binding.bound.operation,
+          adapter_id: binding.bound.adapter_id
+        });
+      }
+      return Object.freeze({
+        customer_target_verified: false,
+        production_ready: false,
+        target_id: bindingPresent(input, "target_id") ? String(input.target_id) : null,
+        environment: bindingPresent(input, "environment") ? String(input.environment) : null,
+        executor_identity: bindingPresent(input, "executor_identity") ? String(input.executor_identity) : null,
+        operation: bindingPresent(input, "operation") ? String(input.operation) : null,
+        adapter_id: bindingPresent(input, "adapter_id") ? String(input.adapter_id) : null
+      });
+    }
+    function evidenceVerifies(claim, query = {}) {
+      if (!claim || claim.customer_target_verified !== true) return false;
+      for (const key of TARGET_BINDING_FIELDS) {
+        if (String(claim[key] || "") !== String(query[key] || "")) return false;
+      }
+      return true;
+    }
+    module2.exports = {
+      TARGET_BINDING_FIELDS,
+      normalizeBound,
+      buildClaim,
+      evidenceVerifies
+    };
+  }
+});
+
+// src/atomic-v2-probes.js
+var require_atomic_v2_probes = __commonJS({
+  "src/atomic-v2-probes.js"(exports2, module2) {
+    "use strict";
+    var NEGATIVE_PROBES = Object.freeze([
+      "replay",
+      "expired_challenge",
+      "wrong_target",
+      "cas_mismatch",
+      "missing_attestation",
+      "mismatched_jti_scope_hash"
+    ]);
+    function isThenable(value) {
+      return value != null && (typeof value === "object" || typeof value === "function") && typeof value.then === "function";
+    }
+    function callOp(wiring, name, args) {
+      const fn = wiring && wiring[name];
+      if (typeof fn !== "function") {
+        const err = new Error(`adapter missing operation ${name}`);
+        err.code = "ADAPTER_OP_MISSING";
+        throw err;
+      }
+      return fn(args);
+    }
+    function settle(invoke) {
+      try {
+        const result = invoke();
+        if (isThenable(result)) {
+          Promise.resolve(result).catch(() => {
+          });
+          return { kind: "async" };
+        }
+        if (result && result.ok === true) return { kind: "ok", result };
+        return { kind: "reject", result, reason: result && result.reason || "ok:false" };
+      } catch (err) {
+        return { kind: "throw", reason: err && (err.code || err.message) || "threw" };
+      }
+    }
+    function otherTarget(targetId) {
+      return `${targetId}__NOT_${targetId}`;
+    }
+    function issued(ch) {
+      return {
+        nonce: ch && ch.state_nonce,
+        jti: ch && ch.jti,
+        scope_hash: ch && ch.scope_hash,
+        digest: ch && ch.current_digest,
+        expires_at: ch && ch.expires_at
+      };
+    }
+    function runPositiveRoundTrip(wiring, bound) {
+      const target_id = bound.target_id;
+      const environment = bound.environment;
+      const operation = bound.operation;
+      const steps = [];
+      const chS = settle(() => callOp(wiring, "state_challenge", { target_id, environment }));
+      if (chS.kind !== "ok" || !chS.result.state_nonce) {
+        return {
+          ok: false,
+          steps,
+          message: `positive state_challenge did not succeed (${chS.kind}/${chS.reason || "no nonce"})`
+        };
+      }
+      steps.push("state_challenge");
+      const { nonce, jti, scope_hash, digest } = issued(chS.result);
+      if (!jti || !scope_hash) {
+        return { ok: false, steps, message: "positive state_challenge did not bind jti/scope_hash" };
+      }
+      const consS = settle(() => callOp(wiring, "consume", {
+        state_nonce: nonce,
+        jti,
+        scope_hash,
+        target_id
+      }));
+      if (consS.kind !== "ok") {
+        return { ok: false, steps, message: `positive consume did not succeed (${consS.kind}/${consS.reason})` };
+      }
+      steps.push("consume");
+      const rbS = settle(() => callOp(wiring, "provider_readback", { target_id }));
+      if (rbS.kind !== "ok" || !rbS.result.digest) {
+        return { ok: false, steps, message: `positive provider_readback did not succeed (${rbS.kind}/${rbS.reason})` };
+      }
+      steps.push("provider_readback");
+      const casS = settle(() => callOp(wiring, "conditional_write", {
+        target_id,
+        expected_digest: rbS.result.digest || digest,
+        payload: "positive-cas"
+      }));
+      if (casS.kind !== "ok" || !casS.result.new_digest) {
+        return { ok: false, steps, message: `positive conditional_write did not succeed (${casS.kind}/${casS.reason})` };
+      }
+      steps.push("conditional_write");
+      const attS = settle(() => callOp(wiring, "executor_attestation", {
+        target_id,
+        operation,
+        digest: casS.result.new_digest
+      }));
+      if (attS.kind !== "ok" || !attS.result.attestation) {
+        return {
+          ok: false,
+          steps,
+          message: `positive executor_attestation did not succeed (${attS.kind}/${attS.reason})`
+        };
+      }
+      steps.push("executor_attestation");
+      const mutS = settle(() => callOp(wiring, "mutate", {
+        target_id,
+        grant: { jti, scope_hash, target_id, expires_at: chS.result.expires_at },
+        payload: "positive-mutate",
+        attestation: attS.result.attestation
+      }));
+      if (mutS.kind !== "ok") {
+        return { ok: false, steps, message: `positive mutate did not succeed (${mutS.kind}/${mutS.reason})` };
+      }
+      steps.push("mutate");
+      return {
+        ok: true,
+        steps,
+        executor_identity: attS.result.executor_identity || null,
+        message: "positive round-trip ok"
+      };
+    }
+    function runNegativeProbes(wiring, bound) {
+      const target_id = bound.target_id;
+      const environment = bound.environment;
+      const results = [];
+      const chReplay = settle(() => callOp(wiring, "state_challenge", { target_id, environment }));
+      if (chReplay.kind !== "ok") {
+        results.push({ name: "replay", failed: false, reason: `setup_${chReplay.kind}` });
+      } else {
+        const iss = issued(chReplay.result);
+        const first = settle(() => callOp(wiring, "consume", {
+          state_nonce: iss.nonce,
+          jti: iss.jti,
+          scope_hash: iss.scope_hash,
+          target_id
+        }));
+        if (first.kind !== "ok") {
+          results.push({ name: "replay", failed: false, reason: "first_consume_did_not_succeed" });
+        } else {
+          const second = settle(() => callOp(wiring, "consume", {
+            state_nonce: iss.nonce,
+            jti: iss.jti,
+            scope_hash: iss.scope_hash,
+            target_id
+          }));
+          results.push({
+            name: "replay",
+            failed: second.kind === "reject" || second.kind === "throw",
+            reason: second.kind === "async" ? "async_unprobed" : second.reason || second.kind
+          });
+        }
+      }
+      const chExp = settle(() => callOp(wiring, "state_challenge", {
+        target_id,
+        environment,
+        now: Date.parse("1999-12-31T00:00:00Z")
+      }));
+      if (chExp.kind !== "ok") {
+        results.push({ name: "expired_challenge", failed: false, reason: `setup_${chExp.kind}` });
+      } else {
+        const iss = issued(chExp.result);
+        const exp = settle(() => callOp(wiring, "consume", {
+          state_nonce: iss.nonce,
+          jti: iss.jti,
+          scope_hash: iss.scope_hash,
+          target_id
+        }));
+        results.push({
+          name: "expired_challenge",
+          failed: exp.kind === "reject" || exp.kind === "throw",
+          reason: exp.kind === "async" ? "async_unprobed" : exp.reason || exp.kind
+        });
+      }
+      const chWrong = settle(() => callOp(wiring, "state_challenge", { target_id, environment }));
+      if (chWrong.kind !== "ok") {
+        results.push({ name: "wrong_target", failed: false, reason: `setup_${chWrong.kind}` });
+      } else {
+        const iss = issued(chWrong.result);
+        const wt = settle(() => callOp(wiring, "consume", {
+          state_nonce: iss.nonce,
+          jti: iss.jti,
+          scope_hash: iss.scope_hash,
+          target_id: otherTarget(target_id)
+        }));
+        results.push({
+          name: "wrong_target",
+          failed: wt.kind === "reject" || wt.kind === "throw",
+          reason: wt.kind === "async" ? "async_unprobed" : wt.reason || wt.kind
+        });
+      }
+      const cas = settle(() => callOp(wiring, "conditional_write", {
+        target_id,
+        expected_digest: "sha256:deadbeef-not-current",
+        payload: "cas-mismatch-probe"
+      }));
+      results.push({
+        name: "cas_mismatch",
+        failed: cas.kind === "reject" || cas.kind === "throw",
+        reason: cas.kind === "async" ? "async_unprobed" : cas.reason || cas.kind
+      });
+      const miss = settle(() => callOp(wiring, "mutate", {
+        target_id,
+        grant: { jti: "jti-no-attest", scope_hash: "scope-no-attest", target_id },
+        payload: "no-attest",
+        attestation: null
+      }));
+      results.push({
+        name: "missing_attestation",
+        failed: miss.kind === "reject" || miss.kind === "throw",
+        reason: miss.kind === "async" ? "async_unprobed" : miss.reason || miss.kind
+      });
+      const chJti = settle(() => callOp(wiring, "state_challenge", { target_id, environment }));
+      if (chJti.kind !== "ok" || !chJti.result.jti) {
+        results.push({ name: "mismatched_jti_scope_hash", failed: false, reason: "setup_no_issued_jti" });
+      } else {
+        const iss = issued(chJti.result);
+        const bad = settle(() => callOp(wiring, "consume", {
+          state_nonce: iss.nonce,
+          jti: `${iss.jti}__NOT`,
+          scope_hash: `${iss.scope_hash}__NOT`,
+          target_id
+        }));
+        results.push({
+          name: "mismatched_jti_scope_hash",
+          failed: bad.kind === "reject" || bad.kind === "throw",
+          reason: bad.kind === "async" ? "async_unprobed" : bad.reason || bad.kind
+        });
+      }
+      const passed = results.filter((r) => r.failed !== true).map((r) => r.name);
+      return {
+        ok: passed.length === 0,
+        results,
+        passed,
+        message: passed.length === 0 ? "all negative probes failed closed" : `negative probes accepted (must fail): ${passed.join(", ")}`
+      };
+    }
+    module2.exports = {
+      NEGATIVE_PROBES,
+      runNegativeProbes,
+      runPositiveRoundTrip
+    };
+  }
+});
+
+// src/atomic-v2.js
+var require_atomic_v2 = __commonJS({
+  "src/atomic-v2.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var {
+      ADAPTER_CONTRACT_VERSION,
+      ADAPTER_OPERATIONS,
+      ADAPTER_CONTRACT,
+      REQUIRED_CAPABILITIES,
+      checkContractVersion
+    } = require_atomic_v2_contract();
+    var { buildClaim, evidenceVerifies, normalizeBound, TARGET_BINDING_FIELDS } = require_atomic_v2_claim();
+    var { runNegativeProbes, runPositiveRoundTrip, NEGATIVE_PROBES } = require_atomic_v2_probes();
+    var CONFIG_REL = ".coderifts/atomic-v2.json";
+    var WIRING_REL = ".coderifts/atomic-v2-wiring.js";
+    var EXIT = Object.freeze({
+      VERIFIED: 0,
+      USAGE: 1,
+      WIRING_REQUIRED: 2,
+      VERIFICATION_FAILED: 3
+    });
+    var STATUS = Object.freeze({
+      PROFILE_CONFIGURED: "PROFILE_CONFIGURED",
+      WIRING_REQUIRED: "WIRING_REQUIRED",
+      TARGET_ENFORCEMENT_VERIFIED: "TARGET_ENFORCEMENT_VERIFIED",
+      VERIFICATION_FAILED: "VERIFICATION_FAILED",
+      ATOMIC_V2_CONFIGURED: "ATOMIC_V2_CONFIGURED",
+      ENFORCING_ATOMIC_V2: "ENFORCING_ATOMIC_V2"
+    });
+    function unconfiguredCapability(name) {
+      const cap = String(name);
+      const fn = function unconfiguredCapabilityPlaceholder() {
+        const err = new Error(
+          `unconfiguredCapability("${cap}"): fail-closed placeholder \u2014 this THROWS, it does not return success. Wire the capability before verify can pass.`
+        );
+        err.code = "UNCONFIGURED_CAPABILITY";
+        err.capability = cap;
+        throw err;
+      };
+      Object.defineProperty(fn, "unconfigured", { value: true, enumerable: true });
+      Object.defineProperty(fn, "capability", { value: cap, enumerable: true });
+      return fn;
+    }
+    function isUnconfiguredFn(fn) {
+      return typeof fn === "function" && fn.unconfigured === true;
+    }
+    function configuredState(missing, opts = {}) {
+      const list = Array.isArray(missing) ? [...missing] : [];
+      const incomplete = list.length > 0;
+      const targetVerified = opts.targetVerified === true && !incomplete;
+      if (incomplete || !targetVerified) {
+        return {
+          profile: "ENFORCING_ATOMIC_V2",
+          contract_version: ADAPTER_CONTRACT_VERSION,
+          configuration_status: STATUS.PROFILE_CONFIGURED,
+          enforcement_status: incomplete ? STATUS.WIRING_REQUIRED : opts.enforcement_status || STATUS.WIRING_REQUIRED,
+          state: STATUS.ATOMIC_V2_CONFIGURED,
+          atomic_v2_verified: false,
+          missing_capabilities: list
+        };
+      }
+      const bound = opts.bound || {};
+      return {
+        profile: "ENFORCING_ATOMIC_V2",
+        contract_version: ADAPTER_CONTRACT_VERSION,
+        configuration_status: STATUS.PROFILE_CONFIGURED,
+        enforcement_status: STATUS.TARGET_ENFORCEMENT_VERIFIED,
+        state: STATUS.ENFORCING_ATOMIC_V2,
+        atomic_v2_verified: true,
+        missing_capabilities: [],
+        target_id: bound.target_id || null,
+        environment: bound.environment || null,
+        executor_identity: bound.executor_identity || null,
+        operation: bound.operation || null,
+        adapter_id: bound.adapter_id || null
+      };
+    }
+    function refuseLie(doc, missing) {
+      if (doc && doc.atomic_v2_verified === true && missing.length > 0) return true;
+      if (doc && doc.state === STATUS.ENFORCING_ATOMIC_V2 && missing.length > 0) return true;
+      if (doc && doc.enforcement_status === STATUS.TARGET_ENFORCEMENT_VERIFIED && missing.length > 0) {
+        return true;
+      }
+      return false;
+    }
+    function wiringSource() {
+      const caps = REQUIRED_CAPABILITIES.map((c) => `  ${c}: unconfiguredCapability(${JSON.stringify(c)}),`).join("\n");
+      return `'use strict';
+
+/**
+ * ATOMIC_V2 wiring \u2014 generated by \`coderifts init --strict --atomic-v2\`.
+ * Normative adapter-contract ${ADAPTER_CONTRACT_VERSION} (not a template).
+ * Each operation is a FAIL-CLOSED placeholder. It THROWS. Replacing one with a
+ * no-op that returns success is how incomplete wiring ships as verified.
+ * Wire the real capability, then run \`coderifts verify atomic-v2 --target \u2026\`.
+ */
+function unconfiguredCapability(name) {
+  const cap = String(name);
+  const fn = function unconfiguredCapabilityPlaceholder() {
+    const err = new Error(
+      'unconfiguredCapability("' + cap + '"): fail-closed placeholder \u2014 '
+      + 'this THROWS, it does not return success. Wire the capability before verify can pass.',
+    );
+    err.code = 'UNCONFIGURED_CAPABILITY';
+    err.capability = cap;
+    throw err;
+  };
+  Object.defineProperty(fn, 'unconfigured', { value: true, enumerable: true });
+  Object.defineProperty(fn, 'capability', { value: cap, enumerable: true });
+  return fn;
+}
+
+module.exports = {
+  contract_version: ${JSON.stringify(ADAPTER_CONTRACT_VERSION)},
+${caps}
+};
+`;
+    }
+    function assertWiringFailClosed(wiringPath) {
+      const wiring = loadWiring(path.resolve(wiringPath));
+      const fn = wiring && wiring.conditional_write;
+      if (typeof fn !== "function") {
+        throw new Error("atomic-v2 wiring missing conditional_write");
+      }
+      let threw = false;
+      try {
+        fn();
+      } catch (err) {
+        threw = true;
+        if (!(err && err.code === "UNCONFIGURED_CAPABILITY")) {
+          throw new Error(
+            `unconfiguredCapability("conditional_write") must throw UNCONFIGURED_CAPABILITY, got ${err && (err.code || err.message)}`
+          );
+        }
+      }
+      if (!threw) {
+        throw new Error(
+          'unconfiguredCapability("conditional_write") must THROW at init, not return success'
+        );
+      }
+    }
+    function writeAtomicV2(outDir, deps = {}) {
+      const writeFile = deps.writeFile || ((p, c) => {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, c, "utf8");
+      });
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const dryRun = !!deps.dryRun;
+      const written = [];
+      const skipped = [];
+      const jsonPath = path.join(outDir, CONFIG_REL);
+      const wiringPath = path.join(outDir, WIRING_REL);
+      const doc = configuredState([...REQUIRED_CAPABILITIES]);
+      if (doc.atomic_v2_verified !== false) {
+        throw new Error("atomic-v2 init refused to write verified:true");
+      }
+      if (doc.state === STATUS.ENFORCING_ATOMIC_V2) {
+        throw new Error("atomic-v2 init refused to write state ENFORCING_ATOMIC_V2 with incomplete wiring");
+      }
+      for (const [rel, body] of [[CONFIG_REL, `${JSON.stringify(doc, null, 2)}
+`], [WIRING_REL, wiringSource()]]) {
+        const dest = path.join(outDir, rel);
+        if (exists(dest) && !deps.force) {
+          skipped.push(rel);
+          continue;
+        }
+        if (!dryRun) writeFile(dest, body);
+        written.push(rel);
+      }
+      if (!dryRun && written.includes(WIRING_REL) && fs.existsSync(wiringPath)) {
+        assertWiringFailClosed(wiringPath);
+      }
+      return { written, skipped, configRel: CONFIG_REL, wiringRel: WIRING_REL, jsonPath, wiringPath, doc };
+    }
+    function loadWiring(wiringPath) {
+      try {
+        delete require.cache[require.resolve(wiringPath)];
+      } catch (_) {
+      }
+      return require(wiringPath);
+    }
+    function isThenable(value) {
+      return value != null && (typeof value === "object" || typeof value === "function") && typeof value.then === "function";
+    }
+    function isPositiveProof(result, name) {
+      return !!(result && typeof result === "object" && result.ok === true && result.capability === name);
+    }
+    function discoverCapabilities(wiring) {
+      const discovery = {};
+      const missing = [];
+      for (const name of REQUIRED_CAPABILITIES) {
+        const fn = wiring && wiring[name];
+        const probe = probeCapability(typeof fn === "function" ? fn : void 0, name);
+        discovery[name] = {
+          wired: !probe.missing,
+          reason: probe.reason,
+          source: "machine_probe"
+        };
+        if (probe.missing) missing.push(name);
+      }
+      return { discovery, missing };
+    }
+    function probeCapability(fn, name) {
+      if (typeof fn !== "function") {
+        return { missing: true, reason: "not_a_function" };
+      }
+      if (isUnconfiguredFn(fn)) {
+        return { missing: true, reason: "unconfiguredCapability" };
+      }
+      try {
+        const result = fn({ probe: true, capability: name });
+        if (isThenable(result)) {
+          Promise.resolve(result).catch(() => {
+          });
+          return { missing: true, reason: "async_unprobed" };
+        }
+        if (!isPositiveProof(result, name)) {
+          return { missing: true, reason: "no_positive_proof" };
+        }
+        return { missing: false, reason: null };
+      } catch (err) {
+        if (err && (err.code === "UNCONFIGURED_CAPABILITY" || /unconfiguredCapability\(/.test(String(err.message || "")))) {
+          return { missing: true, reason: "unconfiguredCapability" };
+        }
+        return { missing: true, reason: "threw", error: err && err.message };
+      }
+    }
+    function evaluateAtomicV2(outDir, boundInput = {}) {
+      const jsonPath = path.join(outDir, CONFIG_REL);
+      const wiringPath = path.join(outDir, WIRING_REL);
+      const unverifiedClaim = () => buildClaim({
+        ...boundInput,
+        customer_target_verified: false,
+        production_ready: false
+      });
+      if (!fs.existsSync(jsonPath)) {
+        return {
+          exitCode: EXIT.USAGE,
+          code: "CONFIG_MISSING",
+          message: `atomic-v2 config not found at ${CONFIG_REL} \u2014 run: coderifts init --strict --atomic-v2`,
+          claim: unverifiedClaim()
+        };
+      }
+      let doc;
+      try {
+        doc = JSON.parse(fs.readFileSync(jsonPath, "utf8"));
+      } catch (err) {
+        return { exitCode: EXIT.USAGE, code: "CONFIG_UNREADABLE", message: err.message, claim: unverifiedClaim() };
+      }
+      if (!fs.existsSync(wiringPath)) {
+        return {
+          exitCode: EXIT.WIRING_REQUIRED,
+          code: STATUS.WIRING_REQUIRED,
+          report: configuredState([...REQUIRED_CAPABILITIES]),
+          claim: unverifiedClaim(),
+          message: `wiring template missing (${WIRING_REL})`
+        };
+      }
+      let wiring;
+      try {
+        wiring = loadWiring(path.resolve(wiringPath));
+      } catch (err) {
+        return {
+          exitCode: EXIT.VERIFICATION_FAILED,
+          code: STATUS.VERIFICATION_FAILED,
+          message: `wiring module failed to load: ${err.message}`,
+          claim: unverifiedClaim()
+        };
+      }
+      const versionCheck = checkContractVersion(wiring);
+      if (!versionCheck.ok) {
+        return {
+          exitCode: EXIT.VERIFICATION_FAILED,
+          code: "CONTRACT_VERSION_MISMATCH",
+          message: versionCheck.message,
+          report: configuredState([...REQUIRED_CAPABILITIES], { enforcement_status: STATUS.VERIFICATION_FAILED }),
+          claim: unverifiedClaim()
+        };
+      }
+      const { discovery, missing } = discoverCapabilities(wiring);
+      const probes = discovery;
+      if (refuseLie(doc, missing)) {
+        return {
+          exitCode: EXIT.VERIFICATION_FAILED,
+          code: STATUS.VERIFICATION_FAILED,
+          message: "atomic-v2 document claims ENFORCING_ATOMIC_V2 / verified:true with incomplete wiring \u2014 refused",
+          report: configuredState(missing, { enforcement_status: STATUS.VERIFICATION_FAILED }),
+          discovery,
+          probes,
+          claim: unverifiedClaim()
+        };
+      }
+      if (missing.length > 0) {
+        return {
+          exitCode: EXIT.WIRING_REQUIRED,
+          code: STATUS.WIRING_REQUIRED,
+          report: configuredState(missing),
+          discovery,
+          probes,
+          claim: unverifiedClaim(),
+          message: `ATOMIC_V2_CONFIGURED / WIRING_REQUIRED \u2014 missing: ${missing.join(", ")}`
+        };
+      }
+      const binding = normalizeBound(boundInput);
+      if (!binding.ok) {
+        return {
+          exitCode: EXIT.VERIFICATION_FAILED,
+          code: "TARGET_BINDING_REQUIRED",
+          message: `target-bound verification requires ${TARGET_BINDING_FIELDS.join(", ")} (missing ${binding.missing}); reference-executor success is not inherited`,
+          report: configuredState([], { enforcement_status: STATUS.VERIFICATION_FAILED }),
+          discovery,
+          probes,
+          claim: unverifiedClaim()
+        };
+      }
+      const positive = runPositiveRoundTrip(wiring, binding.bound);
+      if (!positive.ok) {
+        return {
+          exitCode: EXIT.VERIFICATION_FAILED,
+          code: STATUS.VERIFICATION_FAILED,
+          message: positive.message,
+          report: configuredState([], { enforcement_status: STATUS.VERIFICATION_FAILED }),
+          discovery,
+          probes,
+          positive,
+          claim: unverifiedClaim()
+        };
+      }
+      if (wiring.adapter_id != null && String(wiring.adapter_id) !== binding.bound.adapter_id) {
+        return {
+          exitCode: EXIT.VERIFICATION_FAILED,
+          code: STATUS.VERIFICATION_FAILED,
+          message: `adapter_id mismatch: wiring ${wiring.adapter_id} vs bound ${binding.bound.adapter_id}`,
+          report: configuredState([], { enforcement_status: STATUS.VERIFICATION_FAILED }),
+          discovery,
+          probes,
+          positive,
+          claim: unverifiedClaim()
+        };
+      }
+      if (positive.executor_identity != null && String(positive.executor_identity) !== binding.bound.executor_identity) {
+        return {
+          exitCode: EXIT.VERIFICATION_FAILED,
+          code: STATUS.VERIFICATION_FAILED,
+          message: `executor_identity mismatch: adapter ${positive.executor_identity} vs bound ${binding.bound.executor_identity}`,
+          report: configuredState([], { enforcement_status: STATUS.VERIFICATION_FAILED }),
+          discovery,
+          probes,
+          positive,
+          claim: unverifiedClaim()
+        };
+      }
+      const negatives = runNegativeProbes(wiring, binding.bound);
+      if (!negatives.ok) {
+        return {
+          exitCode: EXIT.VERIFICATION_FAILED,
+          code: STATUS.VERIFICATION_FAILED,
+          message: negatives.message,
+          report: configuredState([], { enforcement_status: STATUS.VERIFICATION_FAILED }),
+          discovery,
+          probes,
+          positive,
+          negatives,
+          claim: unverifiedClaim()
+        };
+      }
+      const claim = buildClaim({
+        customer_target_verified: true,
+        production_ready: true,
+        ...binding.bound
+      });
+      if (!evidenceVerifies(claim, binding.bound)) {
+        return {
+          exitCode: EXIT.VERIFICATION_FAILED,
+          code: STATUS.VERIFICATION_FAILED,
+          message: "claim does not bind the verified target",
+          report: configuredState([], { enforcement_status: STATUS.VERIFICATION_FAILED }),
+          discovery,
+          probes,
+          claim: unverifiedClaim()
+        };
+      }
+      const report = configuredState([], { targetVerified: true, bound: binding.bound });
+      return {
+        exitCode: EXIT.VERIFIED,
+        code: STATUS.TARGET_ENFORCEMENT_VERIFIED,
+        report,
+        discovery,
+        probes,
+        positive,
+        negatives,
+        claim,
+        message: `TARGET_ENFORCEMENT_VERIFIED target_id=${claim.target_id} adapter_id=${claim.adapter_id}`
+      };
+    }
+    module2.exports = {
+      CONFIG_REL,
+      WIRING_REL,
+      REQUIRED_CAPABILITIES,
+      ADAPTER_OPERATIONS,
+      ADAPTER_CONTRACT_VERSION,
+      ADAPTER_CONTRACT,
+      EXIT,
+      STATUS,
+      unconfiguredCapability,
+      isUnconfiguredFn,
+      configuredState,
+      refuseLie,
+      writeAtomicV2,
+      evaluateAtomicV2,
+      wiringSource,
+      assertWiringFailClosed,
+      isPositiveProof,
+      probeCapability,
+      discoverCapabilities,
+      checkContractVersion,
+      buildClaim,
+      evidenceVerifies,
+      normalizeBound,
+      TARGET_BINDING_FIELDS,
+      NEGATIVE_PROBES,
+      runNegativeProbes,
+      runPositiveRoundTrip
+    };
+  }
+});
+
 // src/commands/init-agents.js
 var require_init_agents = __commonJS({
   "src/commands/init-agents.js"(exports2, module2) {
@@ -233897,8 +235067,9 @@ var require_init_agents = __commonJS({
       writeContractGateWorkflow,
       workflowPresent
     } = require_contract_gate_workflow();
+    var { writeAtomicV2, CONFIG_REL, WIRING_REL } = require_atomic_v2();
     if (process.env.NO_COLOR) chalk.level = 0;
-    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,copilot,all] [--no-hook] [--no-workflow] [--strict] [--dry-run] [--check] [--out <dir>]
+    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,copilot,all] [--no-hook] [--no-workflow] [--strict] [--atomic-v2] [--dry-run] [--check] [--out <dir>]
 
   Wire this repository for governed agent work in ONE command:
     1. repo-level MCP config (per host: .mcp.json / .cursor/mcp.json / .vscode/mcp.json)
@@ -233909,7 +235080,8 @@ var require_init_agents = __commonJS({
   --hosts <list>   claude, cursor, copilot, or all (default: all)
   --no-hook        Skip host hook install
   --no-workflow    Skip writing the CI workflow
-  --strict         STRICT workflow: require-verified-monitoring: true (default template stays false)
+  --strict         STRICT workflow: require-verified-monitoring + require-grant (cr.exec.v2 primary; v1 legacy)
+  --atomic-v2      Write ENFORCING_ATOMIC_V2 config + fail-closed wiring placeholders (implies --agents --strict)
   --dry-run        Print the plan without writing
   --check          Report which of the four pieces are present (no write)
   --out <dir>      Target directory (default: cwd)
@@ -233970,9 +235142,9 @@ ${USAGE}`
       return { hosts, allRules: false };
     }
     function agentFlagsRequireAgents(options = {}) {
-      return !!(options.check || options.dryRun || options.out || options.hosts != null && String(options.hosts) !== "all" || options.hook === false || options.workflow === false || options.noHook === true || options.noWorkflow === true || options.strict === true);
+      return !!(options.check || options.dryRun || options.out || options.hosts != null && String(options.hosts) !== "all" || options.hook === false || options.workflow === false || options.noHook === true || options.noWorkflow === true || options.strict === true || options.atomicV2 === true);
     }
-    var AGENT_FLAGS_REQUIRE_AGENTS = "Error: --check/--dry-run/--out/--hosts/--no-hook/--no-workflow/--strict require --agents";
+    var AGENT_FLAGS_REQUIRE_AGENTS = "Error: --check/--dry-run/--out/--hosts/--no-hook/--no-workflow/--strict/--atomic-v2 require --agents";
     var AGENTS_NO_TEMPLATE = "Error: init --agents does not take a template. Did you mean `coderifts init --agents` (not `coderifts init agent`)?";
     function rulePathsForHosts(hosts, allRules) {
       const out = [SHARED_RULE];
@@ -234068,6 +235240,15 @@ ${USAGE}`
       }
       const workflowWanted = wantWorkflow(options);
       const wfPresent = workflowWanted && workflowPresent(outDir, fsDeps);
+      const atomicWanted = options.atomicV2 === true;
+      const atomicMissing = [];
+      const atomicPresent = [];
+      if (atomicWanted) {
+        for (const rel of [CONFIG_REL, WIRING_REL]) {
+          if (fsDeps.exists(path.join(outDir, rel))) atomicPresent.push(rel);
+          else atomicMissing.push(rel);
+        }
+      }
       const pieces = {
         mcp: { present: mcpPresent, missing: mcpMissing },
         rules: { present: rulesPresent, missing: rulesMissing },
@@ -234080,9 +235261,14 @@ ${USAGE}`
           wanted: workflowWanted,
           present: wfPresent,
           missing: workflowWanted && !wfPresent ? [WORKFLOW_REL] : []
+        },
+        atomicV2: {
+          wanted: atomicWanted,
+          present: atomicPresent,
+          missing: atomicMissing
         }
       };
-      const missingCount = mcpMissing.length + rulesMissing.length + hooksMissing.length + (workflowWanted && !wfPresent ? 1 : 0);
+      const missingCount = mcpMissing.length + rulesMissing.length + hooksMissing.length + (workflowWanted && !wfPresent ? 1 : 0) + atomicMissing.length;
       return {
         exitCode: missingCount === 0 ? 0 : 1,
         pieces,
@@ -234115,8 +235301,13 @@ ${USAGE}`
       } else {
         log(pieces.workflow.present ? `  CI workflow:   present  (${WORKFLOW_REL})` : `  CI workflow:   missing  (${WORKFLOW_REL})`);
       }
+      if (pieces.atomicV2 && pieces.atomicV2.wanted) {
+        const st = pieces.atomicV2.missing.length === 0 ? "present" : "missing";
+        const detail = pieces.atomicV2.missing.length === 0 ? pieces.atomicV2.present.join(", ") : pieces.atomicV2.missing.join(", ");
+        log(`  ATOMIC_V2:     ${st}  (${detail})`);
+      }
       log("");
-      if (allPresent) log(chalk.green("  All four pieces present."));
+      if (allPresent) log(chalk.green(pieces.atomicV2 && pieces.atomicV2.wanted ? "  All requested pieces present." : "  All four pieces present."));
       else log(chalk.yellow("  Incomplete \u2014 run: coderifts init --agents"));
     }
     function runInitAgents(options = {}, deps = {}) {
@@ -234240,9 +235431,28 @@ ${USAGE}`
           section: "workflow",
           action: r.action,
           relPath: r.relPath,
-          note: r.action === "create" ? options.strict ? `${GATE_ACTION} (STRICT require-verified-monitoring)` : GATE_ACTION : r.reason
+          note: r.action === "create" ? options.strict ? `${GATE_ACTION} (STRICT require-verified-monitoring + require-grant; cr.exec.v2)` : GATE_ACTION : r.reason
         });
       }
+      if (options.atomicV2) {
+        const av = writeAtomicV2(outDir, { ...fsDeps, dryRun });
+        for (const rel of av.written) {
+          items.push({
+            section: "atomic-v2",
+            action: "create",
+            relPath: rel,
+            note: rel === CONFIG_REL ? "PROFILE_CONFIGURED / WIRING_REQUIRED (atomic_v2_verified:false)" : "fail-closed unconfiguredCapability placeholders"
+          });
+        }
+        for (const rel of av.skipped) {
+          items.push({
+            section: "atomic-v2",
+            action: "skip",
+            relPath: rel,
+            note: "exists; installer does not overwrite"
+          });
+        }
+      }
       const created = items.filter((i) => i.action === "create").length;
       const merged = items.filter((i) => i.action === "merge").length;
       const skipped = items.filter((i) => i.action === "skip").length;
@@ -234287,7 +235497,8 @@ ${USAGE}`
         ["mcp", "MCP config"],
         ["rules", "Agent rules"],
         ["hooks", "Host hooks"],
-        ["workflow", "CI workflow"]
+        ["workflow", "CI workflow"],
+        ["atomic-v2", "ATOMIC_V2"]
       ];
       for (const [key, title] of sections) {
         lines.push(`  ${title}`);
@@ -261428,7 +262639,7 @@ var require_enforce_check = __commonJS({
       "",
       "Query the provider (GitHub) and local workflow files. Report, per layer:",
       "  VERIFIED / NOT_VERIFIED / UNVERIFIABLE(reason).",
-      "inescapable_deploy is true only when every layer is VERIFIED.",
+      "inescapable_deploy is true only when every layer is VERIFIED and MERGEGATE_ENFORCE is observably true.",
       "",
       "Auth: GITHUB_TOKEN (or GH_TOKEN). Never prints token values.",
       "The CodeRifts GitHub App installation cannot query branch protection",
@@ -261585,7 +262796,8 @@ var require_enforce_check = __commonJS({
         // roadmap 1052a — the ruleset surface, which reads without a credential and can establish
         // required_check where classic branch protection is unreadable.
         rulesetsRead,
-        branch
+        branch,
+        mergegateEnforceObserved: options.mergegateEnforceObserved
       });
       const report = {
         command: "enforce --check",
@@ -261693,7 +262905,7 @@ var require_enforce = __commonJS({
       "setup commands (setup-required-check, hook install, deploy-gate guidance).",
       "",
       "--check: query GitHub + local workflows and report VERIFIED / NOT_VERIFIED /",
-      "UNVERIFIABLE per layer. inescapable_deploy is true only when every layer is VERIFIED.",
+      "UNVERIFIABLE per layer. inescapable_deploy is true only when every layer is VERIFIED and MERGEGATE_ENFORCE is observably true.",
       "Does not use the CodeRifts API key. Auth: GITHUB_TOKEN. Read-only.",
       "",
       "DRY-RUN BY DEFAULT \u2014 without --apply, prints what WOULD run and mutates NOTHING.",
@@ -263008,6 +264220,74 @@ Unparseable stdin denies (fail-closed).
   }
 });
 
+// src/commands/verify-atomic-v2.js
+var require_verify_atomic_v2 = __commonJS({
+  "src/commands/verify-atomic-v2.js"(exports2, module2) {
+    "use strict";
+    var path = require("path");
+    var chalk = require_source();
+    var { evaluateAtomicV2, EXIT, STATUS } = require_atomic_v2();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var USAGE = `Usage: coderifts verify atomic-v2 [--out <dir>] [--json]
+         [--target <id>] [--environment <env>] [--executor-identity <id>]
+         [--operation <op>] [--adapter-id <id>]
+
+  Exit 0  TARGET_ENFORCEMENT_VERIFIED (THIS named target fully verified)
+  Exit 2  WIRING_REQUIRED (config installed, placeholders still throw)
+  Exit 3  VERIFICATION_FAILED (wiring present but verification failed / document lied / negatives accepted / target unbound)
+  Exit 1  usage or missing config
+
+  Target-bound: --target --environment --executor-identity --operation --adapter-id.
+  A reference-executor success is not inherited by a different target.
+`;
+    function runVerifyAtomicV2(options = {}, deps = {}) {
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      const doExit = deps.exit !== false;
+      const outDir = options.out ? path.resolve(String(options.out)) : deps.cwd || process.cwd();
+      const result = evaluateAtomicV2(outDir, {
+        target_id: options.target,
+        environment: options.environment,
+        executor_identity: options.executorIdentity,
+        operation: options.operation,
+        adapter_id: options.adapterId
+      });
+      const payload = {
+        exitCode: result.exitCode,
+        code: result.code,
+        message: result.message,
+        report: result.report || null,
+        discovery: result.discovery || null,
+        claim: result.claim || null,
+        negatives: result.negatives || null
+      };
+      if (options.json) {
+        log(JSON.stringify(payload, null, 2));
+      } else {
+        const line = result.message || result.code;
+        if (result.exitCode === EXIT.VERIFIED) log(chalk.green(line));
+        else if (result.exitCode === EXIT.WIRING_REQUIRED) log(chalk.yellow(line));
+        else logErr(chalk.red(line));
+        if (result.report) {
+          log(`  configuration_status: ${result.report.configuration_status}`);
+          log(`  enforcement_status:   ${result.report.enforcement_status}`);
+          log(`  state:                ${result.report.state}`);
+          log(`  atomic_v2_verified:   ${result.report.atomic_v2_verified}`);
+          log(`  missing_capabilities: ${JSON.stringify(result.report.missing_capabilities)}`);
+        }
+        if (result.claim) {
+          log(`  customer_target_verified: ${result.claim.customer_target_verified}`);
+          log(`  production_ready:         ${result.claim.production_ready}`);
+          if (result.claim.target_id) log(`  target_id:                ${result.claim.target_id}`);
+        }
+      }
+      if (doExit) process.exit(result.exitCode);
+      return result;
+    }
+    module2.exports = { runVerifyAtomicV2, USAGE, EXIT, STATUS };
+  }
+});
+
 // corpus/vectors-mcp-fpfn.json
 var require_vectors_mcp_fpfn = __commonJS({
   "corpus/vectors-mcp-fpfn.json"(exports2, module2) {
@@ -264666,6 +265946,10 @@ program.command("deploy-gate").description("Gate a deploy on the current { envir
   const { runDeployGate } = require_deploy_gate2();
   await runDeployGate(options);
 });
+program.command("doctor").description("Would an agent select CodeRifts for a contract change? Structural check (no key), or the 15-fixture benchmark on your own model.").option("--tools <file>", "Your host's tools/list response (array, { tools }, or { result: { tools } })").option("--model <id>", "TIER 1: run the fixtures through this model using YOUR key from the environment").option("--mock", "TIER 1 dry run: a deterministic scripted model. Measures the script, not a model.").action(async (options) => {
+  const { runDoctor } = require_doctor2();
+  await runDoctor(options);
+});
 program.command("publish-gate").description("Gate npm publish on contract-artifact preflight (before=git baseline, after=working tree)").option("--spec <path>", "Contract artifact path (default: git config coderifts.specPath or api/openapi.yaml)").option("--json", "Machine-readable JSON result").action(async (options) => {
   const { runPublishGate } = require_publish_gate();
   const result = await runPublishGate(options);
@@ -264714,14 +265998,14 @@ program.command("grant").description("Execution-grant helpers").command("publish
   }
   process.stdout.write(result.text + "\n");
 });
-program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, copilot, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--strict", "With --agents: STRICT workflow (require-verified-monitoring: true)").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
+program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, copilot, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--strict", "With --agents: STRICT workflow (require-verified-monitoring + require-grant; cr.exec.v2 primary)").option("--atomic-v2", "Write ENFORCING_ATOMIC_V2 config + fail-closed wiring (implies --agents --strict)").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
   const {
     runInitAgents,
     agentFlagsRequireAgents,
     AGENT_FLAGS_REQUIRE_AGENTS,
     AGENTS_NO_TEMPLATE
   } = require_init_agents();
-  if (options.agents) {
+  if (options.agents || options.atomicV2) {
     if (template) {
       console.error(AGENTS_NO_TEMPLATE);
       process.exitCode = 1;
@@ -264734,7 +266018,8 @@ program.command("init [template]").description("Generate a .coderifts.yml from a
       dryRun: !!options.dryRun,
       check: !!options.check,
       out: options.out,
-      strict: !!options.strict
+      strict: !!options.strict || !!options.atomicV2,
+      atomicV2: !!options.atomicV2
     });
     if (result && typeof result.exitCode === "number") {
       process.exitCode = result.exitCode;
@@ -264881,6 +266166,23 @@ hookCmd.command("status").description("Show whether the CodeRifts pre-push hook
   status();
 });
 var corpusCmd = program.command("corpus").description("Reproduce the CodeRifts accuracy proof matrix (MCP always; OpenAPI needs oasdiff)");
+program.command("verify <target>").description("Verify an installed profile. Target: atomic-v2. Exit 0 = TARGET_ENFORCEMENT_VERIFIED (named target); 2 = WIRING_REQUIRED; 3 = VERIFICATION_FAILED; 1 = usage.").option("--out <dir>", "Target directory (default: cwd)").option("--json", "Print the structured status JSON").option("--target <id>", "Bind verification to this target_id").option("--environment <env>", "Bind verification to this environment").option("--executor-identity <id>", "Bind verification to this executor identity").option("--operation <op>", "Bind verification to this operation").option("--adapter-id <id>", "Bind verification to this adapter_id").action((target, options) => {
+  if (String(target) !== "atomic-v2") {
+    console.error(`verify: unknown target "${target}" (use atomic-v2)`);
+    process.exitCode = 1;
+    return;
+  }
+  const { runVerifyAtomicV2 } = require_verify_atomic_v2();
+  runVerifyAtomicV2({
+    out: options.out,
+    json: !!options.json,
+    target: options.target,
+    environment: options.environment,
+    executorIdentity: options.executorIdentity,
+    operation: options.operation,
+    adapterId: options.adapterId
+  });
+});
 corpusCmd.command("verify", { isDefault: true }).description("Evaluate every trust vector and print the proof matrix (exit 1 on any FAIL)").option("--json", "Machine-readable output: { vectors, summary }").action((options) => {
   const { corpusVerify } = require_corpus();
   corpusVerify(options);